• Search for:
    22Jul, 2024
    Six Opportunities for Scientists and Engineers to Learn Programming Using AI Tools Such as ChatGPT
    Six Opportunities for Scientists and Engineers to Learn Programming Using AI Tools Such as ChatGPT

    In today’s scientific and engineering advancement era, AI technologies are revolutionizing how researchers approach programming and data analysis tasks. Here are some opportunities where AI tools like ChatGPT are making a significant impact: personalized tutorials tailored to specific domains, assistance learning complex data visualization libraries and new programming languages, refactoring and understanding legacy code, and challenging assumptions in scientific coding practices. These tools not only expedite learning and enhance productivity but also encourage deeper critical evaluation, fostering innovation and improving code quality across scientific disciplines.

    OPPORTUNITY 1: Using AI to Create Customized Programming Tutorials for Your Domain

    Harnessing AI tools to create personalized programming tutorials tailored to specific scientific or engineering domains is paramount. Traditional tutorials often use generic datasets such as “iris” or “mtcars,” which may lack relevance to learners outside those fields. For example, a geologist learning Python could benefit from tutorials using geological survey data rather than standard datasets like flower measurements or car specifications.

    OPPORTUNITY 2: Using AI to Learn Complex Data Visualization Libraries

    Scientific programmers frequently navigate intricate data visualization tasks. AI can simplify learning complex libraries like Matplotlib or ggplot2 by generating tutorials that align with specific research needs. For instance, a marine biologist aiming to visualize biodiversity trends could receive tailored tutorials on creating dynamic scatterplots that differentiate fish species by color, shape, and size.

    OPPORTUNITY 3: Refactoring Exploratory Code into Maintainable Software

    In scientific research, initial exploratory code often evolves into long-term solutions requiring clarity and maintainability. AI can assist by analyzing code structures and recommending improvements. For example, AI tools can suggest refactoring options such as modularizing analysis scripts or standardizing variable naming conventions, enhancing code readability and sustainability.

    OPPORTUNITY 4: Understanding Inherited Legacy Code

    Scientists frequently inherit complex legacy codes from previous researchers. AI tools can aid by providing detailed explanations and supplementary documentation to demystify inherited codebases. For example, when inheriting climate modeling algorithms, AI can clarify the logic behind temperature variance calculations, facilitating quicker adaptation and modification for new research purposes.

    OPPORTUNITY 5: Learning New Programming Languages on Demand

    Adapting to new programming languages is crucial in scientific endeavors where specific libraries or tools may necessitate rapid skill acquisition. AI can expedite this process by translating example code snippets between languages. For instance, a bioinformatician needing to implement genetic sequence analysis in Julia can utilize AI to translate existing Python scripts into Julia syntax, accelerating the learning curve within their existing computational workflow.

    OPPORTUNITY 6: Questioning Assumptions in Scientific Code

    Ensuring scientific code aligns with accurate assumptions is critical for reliable research outcomes. AI tools can serve as critical evaluators, prompting researchers to justify algorithmic choices and statistical methods. For example, AI can question the rationale behind statistical tests chosen for genomic data analysis, promoting deeper scrutiny of scientific hypotheses and ensuring robust methodological integrity.

    Conclusion

    AI tools like ChatGPT present significant opportunities for scientists and engineers to enhance their programming proficiency and streamline research workflows. By leveraging AI’s capabilities alongside human expertise, researchers can optimize coding practices, accelerate learning of new technologies, and foster rigorous scientific inquiry.

    Reference: https://ieeecs-media.computer.org/media/marketing/cedge_digital/ce-jul24-final.pdf

    16Dec, 2023
    How to Analyze Malware’s Network Traffic in A Sandbox

    Malware analysis encompasses a broad range of activities, including examining the malware’s network traffic. To be effective at it, it’s crucial to understand the common challenges and how to overcome them. Here are three prevalent issues you may encounter and the tools you’ll need to address them.

    Decrypting HTTPS traffic

    Hypertext Transfer Protocol Secure (HTTPS), the protocol for secure online communication, has become a tool for malware to conceal their malicious activities. By cloaking data exchange between infected devices and command-and-control (C&C) servers, malware can operate undetected, exfiltrating sensitive data, installing additional payloads, and receiving instructions from the operators.

    Yet, with the right tool, decrypting HTTPS traffic is an easy task. For this purpose, we can use a man-in-the-middle (MITM) proxy. The MITM proxy works as an intermediary between the client and the server, intercepting their communication.

    The MITM proxy aids analysts in real-time monitoring of the malware’s network traffic, providing them with a clear view of its activities. Among other things, analysts can access content of request and response packets, IPs, and URLs to view the details of the malware’s communication and identify stolen data. The tool is particularly useful for extracting SSL keys used by the malware.

    In this example, the initial file, 237.06 KB in size, drops AxilStealer’s executable file, 129.54 KB in size. As a typical stealer, it gains access to passwords stored in web browsers and begins to transfer them to attackers via a Telegram messenger connection.

    The malicious activity is indicated by the rule “STEALER [ANY.RUN] Attempt to exfiltrate via Telegram”. Thanks to the MITM proxy feature, the malware’s traffic is decrypted, revealing more details about the incident.Malware Analysis

    Use a MITM proxy and dozens of other advanced features for in-depth malware analysis in the ANY.RUN sandbox.Request a free trial

    Discovering malware’s family

    Malware family identification is a crucial part of any cyber investigation. Yara and Suricata rules are commonly used tools for this task, but their effectiveness may be limited when dealing with malware samples whose servers are no longer active.

    FakeNET offers a solution to this challenge by creating a fake server connection that responds to malware requests. Tricking the malware to send a request triggers a Suricata or YARA rule, which accurately identifies the malware family.

    Catching geo-targeted and evasive malware

    Many attacks and phishing campaigns focus on specific geographic regions or countries. Subsequently, they incorporate mechanisms like IP geolocation, language detection, or website blocking which may limit analysts’ ability to detect them.

    Alongside geo-targeting, malware operators may leverage techniques to evade analysis in sandbox environments. A common approach is to verify whether the system is using a datacenter IP address. If confirmed, the malicious software stops execution.

    To counter these obstacles, analysts use a residential proxy. This nifty tool works by switching the IP address of the analyst’s device or virtual machine to ordinary users’ residential IPs from different parts of the world.

    This feature empowers professionals to bypass geo-restrictions by mimicking local users and study malicious activities without revealing their sandbox environment.

    Try all of these tools in ANY.RUN

    Setting up and using each of the aforementioned tools individually can take a lot of effort. To access and utilize all of them with ease, use the cloud-based ANY.RUN sandbox.

    The key feature of the service is interactivity, allowing you to safely engage with malware and the infected system just like you would on your own computer.

    You can explore these and numerous other features of ANY.RUN, including private space for your team, Windows 7, 8, 10, 11 VMs, and API integration completely for free.

    Just use a 14-day trial, no strings attached.

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

    Resource : https://thehackernews.com/2023/12/how-to-analyze-malwares-network-traffic.html

    24Nov, 2023
    Introducing Bambdas

    You’ve might have heard of Lambdas. But have you heard of Bambdas? They’re a unique new way to customize Burp Suite directly from the UI, using only small snippets of Java.

    Changing the face of Burp Suite

    The introduction of Bambdas exposes some of the core “behind the scenes” functionality of Burp Suite for the very first time. In essence, as the feature is rolled out across various tools within Burp Suite, you’ll be able to customize Burp to make it work in exactly the way that you want it to.

    The possibilities contained within the Bambdas functionality are theoretically endless. As the feature develops, we believe it’ll enable you to replace the age-old frustrated cry of “Why can’t Burp do this?” with a shiny new phrase. “I wonder if I can create a Bambda to make this work the way I need it to?”.

    How to work with Bambdas

    The first Bambda we’ve introduced enables you to write custom filters for the Proxy HTTP history. To help you get to grips with the unique potential of this functionality, we’ve created some examples to showcase some interesting request and response filters you might want to try.

    Find requests with a specific cookie value

    //Find requests with a specific cookie value
    if (requestResponse.request().hasParameter("foo", HttpParameterType.COOKIE)) {
    var cookieValue = requestResponse
    .request()
    .parameter("foo", HttpParameterType.COOKIE)
    .value();

    return cookieValue.contains("1337");
    }

    return false;

    Find JSON responses with wrong Content-Type

    //Find JSON respones with wrong Content-Type
    //The content is probably json but the content type is not application/json

    var contentType = requestResponse.response().headerValue("Content-Type");

    if (contentType != null && !contentType.contains("application/json")) {
    String body = requestResponse.response().bodyToString().trim();

    return body.startsWith( "{" ) || body.startsWith( "[" );
    }

    return false;

    Find role within JWT claims

    //Find role within JWT claims
    var body = requestResponse.response().bodyToString().trim();

    if (requestResponse.response().hasHeader("authorization")) {
    var authValue = requestResponse.response().headerValue("authorization");

    if (authValue.startsWith("Bearer ey")) {
    var tokens = authValue.split("\\.");

    if (tokens.length == 3) {
    var decodedClaims = utilities().base64Utils().decode(tokens[1], Base64DecodingOptions.URL).toString();

    return decodedClaims.toLowerCase().contains("role");
    }
    }
    }

    return false;

    Some helpful Bambdas code snippets

    Once you’re comfortable with the basics of how Bambdas work, there are a few tricks you might want to utilize to help you get even more value from the functionality. If you’re using something a lot, and want to save yourself some time, you can assign it to a variable. For example:var request = requestResponse.request();

    If you want to check if a parameter exists, and if it’s value is present, you can request it by name and check it for null instead:var cookie = request.parameter("foo", HttpParameterType.COOKIE);

    So that you can see how these code snippets can be applied, we’ve recreated the first example on finding requests with a specific cookie value.

    Hear from the developers of Bambdas

    Sean from the development team is here to introduce you to Bambdas, a unique new way to customize Burp Suite on the fly with small snippets of Java. You’ll learn what a Bambda is, why we’ve built them into Burp Suite, and see a couple of examples of how Bambdas work.

    Resource : https://portswigger.net/blog/introducing-bambdas

    10Nov, 2023
    New BlazeStealer Malware in PyPI Targets Developers

    A new set of malicious Python packages has been discovered on the Python Package Index (PyPI) repository. These packages masquerade as harmless obfuscation tools but contain a malware called BlazeStealer, reported Checkmarx.

    Diving into details

    • The campaign started in January 2023 and includes eight packages – Pyobftoexe, Pyobfusfile, Pyobfexecute, Pyobfpremium, Pyobflite, Pyobfadvance, Pyobfuse, and pyobfgood. 
    • The BlazeStealer malware can execute a number of malicious actions on the infected host, including harvesting sensitive information such as passwords and screenshots, executing arbitrary commands, encrypting files, and disabling Microsoft Defender Antivirus.
    • The malware runs a Discord bot to facilitate communication between the threat actor and the infected system.
    • Most downloads originated from the U.S., China, and Russia, followed by Ireland, Hong Kong, Croatia, France, and Spain.

    Related incidents

    • Phylum uncovered a set of npm modules—puma-com, erc20-testenv, blockledger, cryptotransact, and chainflow–that can stealthily deliver a next-stage malware.
    • In October, Checkmarx observed a sophisticated attacker deploying malicious packages in PyPi and npm, accumulating nearly 75,000 downloads. The campaign was launched in April.

    The bottom line

    Open-source software provides a rich environment for germinating new ideas, but it also requires a healthy dose of skepticism. Developers must stay alert and thoroughly assess the reliability and safety of packages before incorporating them into their work.

    Resource : https://cyware.com/news/new-blazestealer-malware-in-pypi-targets-developers-666fe1bd

    8Nov, 2023
    Performance Development: Unlock Your Team’s Potential

    SHRM defines performance management as “the process of maintaining or improving employee job performance through the use of performance assessment tools, coaching, and counseling as well as providing continuous feedback.”

    But far too many organizations stop at the first part — performance assessment — and miss the opportunity to actually improve employee performance. Only about one in four employees strongly agree that their manager provides meaningful feedback to them or that the feedback they receive helps them do better work. And only 21% of employees strongly agree that their performance is managed in a way that motivates them to do outstanding work.

    Best-in-class organizations are integrating continuous feedback and development to enable more effective performance management. This approach is often referred to as performance development — think of it as the place where performance management meets career development — and it can be a great way to unlock your team members’ full potential.

    The benefits of performance development

    Performance development goes beyond traditional employee reviews to focus on fostering continuous growth, skills enhancement, and career progression.

    Investing in a more robust approach to performance management has many benefits, including: 

    • Building emerging skill sets. Skills sets for jobs have changed by around 25% since 2015 — and this number is expected to grow to 65% by 2030. Effective performance management can help your team members identify and learn the in-demand and emerging skills they need to be successful in their current roles — and in their future ones. 
    • Increasing employee engagement. Performance development demonstrates the direct connection between feedback and career growth, motivating employees to go above and beyond at work. In fact, Gallup found that development is a top driver of employee engagement.
    • Reducing turnover. Continuous feedback and development shows your organization’s commitment to an employee’s long-term success, making your team members more likely to stay. The Josh Bersin Company found that organizations that offer ongoing skill development to their employees are 7.2x more likely to retain and engage their employees than those that don’t.
    • Improving business outcomes. Upskilling, engaging, and retaining talented team members through effective performance development practices can make a tremendous impact on your organization’s success. Companies that facilitate career development are 4x more likely to innovate effectively and 2.6x more likely to exceed financial targets.

    Building a performance management program that encourages career development

    Effective performance management is more than an annual event — it’s an ongoing process of goal setting, employee development, performance evaluation, and rewards. Each should be discussed regularly to nurture an engaged, motivated, and highly skilled workforce.

    Align on goals and performance expectations

    Just 50% of employees clearly understand what’s expected of them at work and only 21% strongly agree they have performance metrics that are within their control. Ambiguity and uncertainty around job expectations can hinder performance and negatively impact engagement.

    Discussing goals and expectations with each of your team members is a critical step toward effective performance management. Employees should understand how their success is being measured and feel empowered to accomplish their goals.

    Begin discussions on goal setting during your employee onboarding process by reviewing the job description, organizational goals, and your team member’s expected impact. Work together to build achievable short- and long-term goals, revisiting them during check-ins and performance reviews to gauge progress and make adjustments. 

    Employees whose managers involve them in goal setting are 3.6x more likely than other employees to be engaged, making this a worthwhile step in your performance management process.

    Build and maintain employee development plans

    Every employee has opportunities to learn and develop — and most want to. More than four out of five employees (83%) say that improving their skills is one of their top priorities. 

    Hold regular conversations with your team members to learn about each person’s professional growth goals, career aspirations, and skills they’d like to master. Then find the intersection of your team member’s development goals and your business needs to create a personalized performance development plan for each employee. 

    Performance development should go beyond addressing areas for improvement to also include honing strengths, learning emerging skills, and reskilling. Employees’ top motivation to learn is progress toward career goals, so it’s crucial to get your team members’ feedback and buy-in around their development plan to ensure alignment.

    Update development plans as your team members acquire new skills and identify additional opportunities for professional growth. The most effective development plans are flexible to accommodate evolving needs and interests.

    Provide continuous feedback

    Only 21% of U.S. employees strongly agree they have received meaningful feedback in the last week, with nearly half saying they receive feedback a few times a year or less. In other words, most employees don’t get enough performance feedback to understand what they’re doing well or when they need a course correction.

    Effective performance development requires that feedback be given consistently so employees have the guidance they need to be successful in their roles. Things you can do to make sure this happens include:

    • Initiate casual conversations. Let employees know when you see commendable efforts or teachable moments in their day-to-day work. Frequent feedback lets your team members know how you feel about their current performance and guides their development. Record the feedback in your performance management system so it can be referenced during future performance discussions.
    • Plan regular check-ins. Schedule regular one-on-one meetings to discuss progress toward goals, challenges, and development needs. These informal check-ins are a great opportunity to go in-depth on performance development discussions so you can make necessary adjustments to employee goals and development plans. 
    • Conduct regular performance evaluations. Plan comprehensive performance reviews at regular intervals to assess your employee’s overall performance and goal attainment. If you do performance development well, employees shouldn’t be hearing any feedback for the first time during the review process.

    Reward your team members for professional development

    Rewarding your team members for professional development acknowledges their effort and demonstrates the value your organization places on learning and growth. It can also help you retain employees: Compensation and career progression are among the top reasons for turnover.

    Offer raises and promotions as appropriate to reward your team members for developing their skill sets and gaining new experiences. This is particularly important if your employee’s new competencies or responsibilities qualify them for a higher pay grade or job level according to your compensation strategy.

    Final thoughts: Effective performance management is an ongoing process

    Gone are the days where an annual review is considered sufficient to manage employee performance. Modern teams encourage ongoing performance development to help employees achieve professional growth and meet evolving organizational goals. This approach can help you unlock your team’s full potential and drive your company’s success.

    Resource : https://www.linkedin.com/business/talent/blog/learning-and-development/performance-development

    8Nov, 2023
    The 10 most in-demand hard skills for 2023

    Technical roles are some of the most competitive for employers to fill, so it’s not surprising that many of the most in-demand hard skills align with these roles.

    The most in-demand hard skills this year are:

    1. Software development

    The COVID-19 pandemic accelerated the digital transformation and software development skills are needed to support this shift. Several popular programming languages, including Python, Java, and JavaScript, are also among the most in-demand hard skills for 2023.

    Reskill/upskill: Programming Foundations: Fundamentals with Annyce Davis. Get certified via this learning path: Career Essentials in Software Development

    2. SQL

    Many companies manage and analyze large, complex data sets in order to perform key business functions. SQL is an essential skill to retrieve and understand that data so it can be used to make informed business decisions.

    Reskill/upskill: SQL Essential Training with Walter Shields

    3. Finance

    Finance skills have always been a core need for most businesses, though looming economic uncertainty makes it more important for companies to get their finances in order. Careful planning can help companies forecast for various scenarios so they can adapt to unpredictable market conditions — whether that means an economic contraction or expansion.

    Reskill/upskill: Reading Corporate Financial Statements with Denise Probert

    4. Python

    Python is one of the most used programming languages today — and it will likely remain so for the foreseeable future. Python’s compatibility with all major operating systems and wide range of use cases makes it a worthwhile skill for technical workers to master.

    Reskill/upskill: Python Essential Training with Ryan Mitchell

    5. Java

    Java is another popular open-source programming language. Like Python, it’s platform-independent and has a broad range of applications. It’s most useful for designing web and phone apps, as well as cloud computing, making it hyper-relevant in our increasingly digital world.

    Reskill/upskill: Hands-On Introduction: Java with Angie Jones

    6. Data analysis

    Data is collected in every business function and must be analyzed to gain insights that can be used to make informed decisions. Effective data analytics can help organizations optimize performance and reduce costs.

    Reskill/upskill: Learning Data Analytics: 1 Foundations with Robin Hunt. Get certified with this learning path: Career Essentials in Data Analysis

    7. JavaScript

    JavaScript is a scripting language that’s used to develop dynamic web pages and platforms that automatically update with the latest information and multimedia required. As the most commonly used programming language, JavaScript is already familiar to many developers.

    Reskill/upskill: JavaScript Essential Training with Morten Rand-Hendriksen

    8. Cloud computing

    Cloud computing has largely displaced on-premise software due to increased accessibility, scalability, and cost savings. Engineers with cloud computing skills are still in very high demand as companies build and maintain these solutions. 

    9. Operations

    Operations skills help organizations manage their resources and processes so they run more efficiently. This can result in improved productivity, lower costs, and a stronger competitive advantage.

    Reskill/upskill: Quality Management for Operational Excellence with Richard Chua

    10. Customer relationship management (CRM)

    It’s easier — and less expensive — to retain an existing customer than it is to find a new one. Customer relationship management skills enable workers to build strong relationships with their current and prospective customers so they can increase loyalty and repeat business.

    Resource : https://www.linkedin.com/business/talent/blog/talent-strategy/linkedin-most-in-demand-hard-and-soft-skills

    30Oct, 2023
    New Project Analyzes and Catalogs Vendor Support for Secure PLC Coding

    ATLANTA – SECURITYWEEK 2023 ICS CYBERSECURITY CONFERENCE – A new project aims to make it easier for PLC programmers to implement secure coding practices by analyzing and cataloging useful files and functions from each PLC vendor.

    The new project was presented on Tuesday at SecurityWeek’s ICS Cybersecurity Conference in Atlanta by David Formby, CEO and CTO of Fortiphyd Logic, a company that specializes in endpoint detection for programmable logic controllers (PLCs) and virtual industrial control systems (ICS) security training labs.

    The project builds on the ‘Top 20 Secure PLC Coding Practices’, whose goal is to provide PLC programmers with guidelines for improving security. 

    Some of these practices apply to all PLCs, regardless of vendor. This includes modularizing code, leaving operational logic directly in the PLC, assigning registers by function, using correlation and input plausibility checks, monitoring PLC uptime, trapping false negatives/positives, restricting third-party data interfaces, defining a safe start state in case of a restart, and validating timers, paired input/output, and indirections. 

    However, some secure PLC coding practices are different for each vendor and it can be difficult to identify relevant documentation. The goal of the Fortiphyd Logic project is to provide the information needed for vendor-specific practices in an easy-to-digest format. 

    The information is provided in a table format and includes the product name and model, whether required functionality is supported, and the file or function that enables access to the required data. 

    One secure PLC coding recommendation whose implementation is different for each vendor involves tracking the device’s operating mode. PLCs can have various modes, such as ‘run’, ‘program’, ‘test’ and ‘debug’. It’s easier for an attacker to hack a PLC that is not in ‘run’ mode, which is why it’s important that PLCs are not left in ‘program’, ‘test’ and ‘debug’ modes. In addition, mode changes should be monitored in order to detect a potential attack. 

    However, monitoring mode changes is done differently for each PLC, Formby pointed out. For instance, in the case of Rockwell Automation PLCs, the data can be obtained through the ‘GSV(ControllerDevice.Status)’ instruction or from a status file, while in the case of Siemens PLCs this can be achieved using the ‘GET_DIAG’ function.

    Another vendor-specific secure PLC coding practice involves monitoring flags that indicate various errors and faults, which can be triggered by malicious attacks. However, PLCs from each vendor have different errors and faults and there are different ways of reading them, Formby explained. 

    Attackers targeting PLCs can make changes to the PLC logic and some controllers have checksums that enable users to detect changes in logic. Monitoring checksums can be useful for detecting attacks, but different vendors have different functions for achieving this and in some cases checksum monitoring is not supported at all. 

    Other examples of vendor-specific PLC secure coding practices covered by Fortiphyd Logic’s new project include monitoring cycle times, hard stops, and memory usage, as well as the detection of unused software. 

    For the time being, the new project, hosted on GitHub, only provides information for products made by Schneider Electric, Siemens and Rockwell Automation, but information will be added for other vendors as well, with the goal being to cover all PLC vendors. Anyone can contribute to the project. 

    Fortiphyd Logic has also created a custom module for the top 20 secure PLC coding practices for CISA’s Cyber Security Evaluation Tool (CSET), which provides a series of requirement questionnaires to help organizations assess their security posture.

    Resource : https://www.securityweek.com/new-project-analyzes-and-catalogs-vendor-support-for-secure-plc-coding/?web_view=true

    16Oct, 2023
    Is Google Authenticator irreplaceable?

    How authenticator apps work and what alternatives there are to Google Authenticator.

    Many online services allow (and sometimes even require) you to set up two-factor authentication (2FA) with one-time codes. Google Authenticator is the most well-known and widely used authenticator app that generates such codes. Almost all services are compatible with it, and some even provide a link to the app when you set up 2FA. But is Google Authenticator the only option, or should you give one of the many alternatives — like Microsoft Authenticator or Twilio Authy — a whirl?

    Since these alternatives exist and clearly have a userbase, you might assume they could be full-fledged replacements for Google Authenticator. But what, if any, are the pitfalls? For those who have no time to read to the end, here’s the answer straight away: don’t worry, Google Authenticator is more than replaceable. But if you’re curious about the whats, whys, and hows — read on…

    How authenticators work

    Let’s start with how authenticator apps work in general. Several open standards for strong authentication have been created under the umbrella of the Initiative for Open Authentication (OATH). Authenticator apps are based on these standards (along with some other things, but which aren’t the topic of this post).

    OATH HOTP

    Way back in 2005, the OATH HOTP (hash-based one-time password) authentication standard appeared. This laid down the fundamentals of authentication using one-time codes that are synchronously generated on the client and server sides.

    The idea is that both the app and the service you’re using — remember the same secret key. Next, a cryptographic algorithm is applied to generate a unique code based on this key and a counter value. A counter is essentially a number that increments each time a new one-time code is generated. The data for calculating this code is the same on both sides, so if everything goes according to plan, the two codes will be identical. What remains is to compare them: should the code you entered match the server-generated one, the authentication is successful.

    After each request for a generation session, the counter value changes so that the code is one-time and unique. An algorithm is used that rules out performing reverse calculations and extracting the secret key from this code. So even if someone intercepts the one-time code, they won’t be able to calculate the secret key, reproduce the authenticator, and generate their own new codes.

    There are two main issues with HOTP. First, the counter values easily get out of sync. For example, if you request the authenticator to generate a code but don’t use it, the client-side authenticator changes the counter value, while on the service side it remains the same. As a result, the generated codes no longer match. Second, the code stays valid until the counter value changes — potentially giving an attacker time to use the intercepted code if they somehow manage to distract the victim.

    OATH TOTP

    In 2011, a new standard was unveiled — OATH TOTP (time-based one-time password), which uses the current time as a counter. The principle remains the same: a secret key known to both parties is used to calculate a one-time code with the same cryptographic algorithm. And because the counter is based on Unix time, the code automatically changes at regular intervals, regardless of whether or not it is used.

    Any internet-connected device now knows the exact time, so there’s no need to worry about one-time codes being out of sync. And since the interval after which the code changes is set rather short (30 seconds by default), if a one-time code is intercepted, the attacker won’t have much time to use it.

    Basic principles of authenticators

    These two standards are used by authenticator apps. TOTP is the more common of course, simply because it’s better in every way, but HOTP can still be found in some prehistoric implementations.

    When creating an authenticator, the client and the server must set a common standard and share the key — this is the absolute minimum required for the authenticator app to work. Additional parameters can also be set for creating tokens. How do the app and the service come to an arrangement? In most cases, by means of a QR code. And this leads us to the next question: how does these codes work?

    Authenticator QR code content

    As far as I know, this is not among the standards developed by OATH, but rather a voluntary adherence to the format set by Google Authenticator. But either way, app-based authentication systems tend to use QR codes, in which a link (strictly speaking, a Uniform Resource Identifier, or URI) containing all the necessary information is encoded. Here’s an example of what it looks like:

    otpauth://totp/Google:alanna@gmail.com?secret=IN2XE2LPOVZSYIDBOJSW4J3UEB4W65J7&issuer=Google&algorithm=SHA1&digits=6&period=30

    As you can see, a whole bunch of parameters are transferred in the QR code, indicating the following:

    • The purpose of the URI — creation of an authentication token (that’s what otpauth at the beginning is for)
    • The authenticator standard, HOTP or TOTP; in this case, TOTP
    • The token label to be displayed inside the app — in our example, Google
    • The username — in this case, alanna@gmail.com
    • The secret key from which the codes are generated (in Base32 format) — the most important part, a long string of random characters
    • The name of the service that created the URI — in our example, Google again
    • The algorithm used to generate the codes — in this case, SHA1
    • The length of generated codes — usually six characters as shown here, but other variants are acceptable
    • The period of time after which the code expires — usually 30 seconds, but other intervals can be set.

    QR codes can pass a whole bunch of authentication token parameters

    In fact, as we mentioned above, many of these parameters can be omitted. The token label and the username can be arbitrary, while the name of the service isn’t required at all — this information has no impact on code generation, and is there mainly for convenience. Some other parameters also aren’t mandatory. The authenticator uses the default code generation algorithm (SHA1) and produces a six-digit code with a 30-second update period unless encoded otherwise in the URI.

    Essentially, the service and the authenticator only need to set the standard (HOTP or TOTP) and share the secret key. Thus, the following URI and QR code would yield exactly the same authentication token in functional terms as the previous pair:

    Many QR code parameters can be omitted or set to arbitrary values; the main thing is to share the secret key and set a standard (HOTP or TOTP)

    The bottom line is that most services that use app-generated codes for authentication operate with such QR codes. Any authenticator app, in turn, has support for reading such QR codes and converting them into authentication tokens, which, in turn, generate the one-time codes. So, instead of Google Authenticator, you can choose any of the dozens of alternatives that take your fancy.

    A few exceptions: services that are incompatible with regular authenticators

    For some reason that’s beyond me, not everyone in the IT industry follows the above standards: some prefer to come up their own. Here are some companies whose services and programs are not compatible with third-party authenticator apps (including Google Authenticator).

    • Apple. The guys at Cupertino have their own 2FA system, which uses no third-party apps at all. Instead, the one-time codes are generated by the operating system simultaneously on all devices linked to an Apple ID. That’s how they roll!
    • Valve and Blizzard. For security on Steam and Battle.net, the developers offer 2FA of their own creation: Steam Guard (built into Steam apps for both Android and iOS) and Battle.net Authenticator, respectively. As far as I know, there’s only one third-party authenticator app that supports these systems: WinAuth.
    • Microsoft. For Microsoft account authentication, you have to install Microsoft Authenticator. On the upside, there’s no need to enter any codes: just confirm login by tapping a button in the app. As a bonus, Microsoft Authenticator also generates standard authentication tokens, which makes it a solid alternative to Google Authenticator. Incidentally, you don’t need a Microsoft account to use it.
    • Adobe. The graphics software developer offers its own app for 2FA — Adobe Account Access — which works with similar logic to Microsoft Authenticator: login to your Adobe account is authenticated by tapping a button, not sending a code. In theory, the app also supports the creation of tokens for authentication in third-party services. However, to get Adobe Account Access to work, you must first link the app to your Adobe account, which, based on App Store and Google Play reviews, isn’t advised.

    So, do I have to use Google Authenticator?

    Not necessarily. All services that work with Google Authenticator will let you set up two-factor authentication using any alternative app. What’s more, many of them have significant advantages over Google’s creation.

    Incidentally, we have a post about the most interesting authenticators for each popular operating system — Android, iOS, Windows, and macOS. And finally, if you’ve read this text in its entirety, then something tells us you might be interested in andOTP if you’re on Android, and OTP auth if you’re on iOS.

    Resource : https://www.kaspersky.com/blog/authenticator-apps-compatibility/47063/

    25May, 2023
    GitLab ‘strongly recommends’ patching max severity flaw ASAP

    GitLab has released an emergency security update, version 16.0.1, to address a maximum severity (CVSS v3.1 score: 10.0) path traversal flaw tracked as CVE-2023-2825.

    GitLab is a web-based Git repository for developer teams that need to manage their code remotely and has approximately 30 million registered users and one million paying customers.

    The vulnerability addressed in the latest update was discovered by a security researcher named ‘pwnie,’ who reported the issue on the project’s HackOne bug bounty program.

    It impacts GitLab Community Edition (CE) and Enterprise Edition (EE) version 16.0.0, but all versions older than this aren’t affected.

    The flaw arises from a path traversal problem that allows an unauthenticated attacker to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.

    The exploitation of CVE-2023-2825 could expose sensitive data, including proprietary software code, user credentials, tokens, files, and other private information.

    This prerequisite suggests that the issue relates to how GitLab manages or resolves paths for attached files nested within several levels of group hierarchy. However, due to the criticality of the problem and the freshness of its discovery, not many details were disclosed by the vendor this time.

    Instead, GitLab highlighted the importance of applying the latest security update without delay.

    “We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible,” reads GitLab’s security bulletin.

    “When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, this means all types are affected.”

    A mitigating factor is that the vulnerability can only be triggered under specific conditions, i.e., when there’s an attachment in a public project nested within at least five groups, which is not the structure followed in all GitHub projects.

    Nevertheless, all users of GitLab 16.0.0 are recommended to update to version 16.0.1 as soon as possible to mitigate the risk. Unfortunately, no workarounds are available at this time.

    Resource : https://www.bleepingcomputer.com/news/security/gitlab-strongly-recommends-patching-max-severity-flaw-asap/

    17Mar, 2023
    The Best VPN Services of 2023

    Our expert team have tested dozens of VPNs, looking at everything from streaming capabilities and speed to security and privacy. Here are BleepingComputer’s top picks for the Best VPNs in 2023.

    Consumer VPNs, or Virtual Private Networks, have grown from a niche technology to a tool used by hundreds of millions of internet users in just a few years. It makes sense: bulk data collection is now the norm, by both private organizations and governments, so it’s only natural people would look for a way to take back control of their digital privacy.

    So which VPN should you use? That’s a tricky question since the answer depends on your priorities and how you use the internet. Some providers might offer first-class security or speeds, while others pride themselves on their ability to access region-locked streaming services. In other words, the best VPN for somebody else might not be the best VPN for you.

    That’s why we’ve carefully examined dozens of leading VPN providers and whittled our list down to seven that really stand out. No matter your requirements, there’s sure to be a VPN below that’s up to the task.

    Best VPN services of 2023

    1. NordVPN: Our best VPN service for 2023. A well-known provider that continuously pushes the boundaries of what a VPN is, with unique features like Tor over VPN servers and MeshNet for creating secure point-to-point connections. Comes with a risk-free 30-day money-back guarantee.
    2. Surfshark: Best VPN for those on a budget. Connect any number of devices. Works with popular streaming services and has a 30-day money-back guarantee. Includes ad blocking and malware filtering.
    3. ExpressVPN: Quick, versatile, and easy to use, with a network spanning 94+ countries. Includes a custom app for routers, parallel connection technology for faster speeds, and reliable access in China. Unique features include a GUI app for Linux and rotating IP addresses.
    4. CyberGhost: A fast and secure VPN that is easy to use, ideal for streaming, and provides a lengthy 45-day money-back guarantee. Superb value for money.
    5. Mullvad: Fast, privacy-first VPN with one low price, no matter how long you subscribe for.
    6. ProtonVPN: Great for secure streaming. Offers a free plan with no bandwidth limits.
    7. IPVanish: Has lots of security tools, a verified no-logs policy, and industry-leading speeds.
    8. Atlas VPN: Newer VPN already offering competitive performance and innovative privacy tools.

    Resource : https://www.bleepingcomputer.com/vpn/guides/best-vpn/